We collect the details you send through our order, quote and contact forms, by email or phone, and through chat if you switch it on. This policy explains the form database, email delivery, service providers, retention periods and how to ask for a copy, correction or deletion. We run no analytics or advertising trackers and do not sell personal information.
Who we are and what this covers
Gearhold LLC is a Wyoming limited liability company. Our operational and customer-service address is 104 S Cherry St, Tunnel Hill, GA 30755, USA. We sew fixed-gear pedal straps by hand and sell them at fixedgearstraps.com. Where this policy says we or us, that is who it means.
This policy covers the website and the business behind it: form requests, messages, phone notes, orders, quotes and guarantee records. Section 2.0 describes website collection and 3.0 describes the forms.
Under EU and UK data protection law we are the controller of the personal data described here. We have not appointed a Data Protection Officer and we have not appointed an EU or UK representative. We are one bench, the processing below is occasional and low risk, and we would rather say that plainly than imply a compliance department that does not exist.
The sibling documents pick up where this one stops: /legal/cookies for the cookie inventory, /legal/trust-security for how we look after what we hold, /legal/your-data for the step-by-step on making a request, and /legal/terms for what you are actually buying.
What the website collects
The site has no customer accounts, login, cart, card field or newsletter signup. Card checkout happens on Stripe’s own page at buy.stripe.com, covered in 6.0. Our forms send requests to us. Our own code sets no cookies and writes nothing to local storage, session storage or a browser database; form requests are stored on the server as described in 3.0.
We do not use the following tools:
- No analytics of any kind. No Google Analytics, no Plausible, no Fathom, no Mixpanel, no Hotjar.
- No advertising, no retargeting, no Meta pixel, no tag manager, no tracking pixels of any sort.
- No fingerprinting, no A/B testing, no session recording.
- No CRM, no social embeds, no social login, no captcha, no map embed, no video embed.
Termly runs the consent banner and the Cookie Settings control in the footer. It stores your choice in your browser and reports it to Termly’s consent service, so the banner remembers your answer and there is a consent record.
tawk.to loads automatically only after you opt in to Termly’s Performance category. You can also load and open it by clicking the “Chat with the bench” button, even if you declined that category. Before either action, no tawk.to code loads, no connection to tawk.to is made and no tawk.to cookie is set. While active, the widget can begin a visitor session before you send a message. It processes your messages and submitted details; IP address and browser or device data; pages viewed and session activity; approximate location; and timestamps. tawk.to and its subprocessors use these to deliver, monitor and troubleshoot chat, provide security, answer you and follow up.
If you neither opt in nor click the chat button, tawk.to stays unloaded. Do not type card numbers, account credentials or highly sensitive information into chat. There are no card fields on this site and we will not ask for card details in chat.
Cloudflare serves the pages and handles the inquiry endpoint. Serving a page involves connection data such as IP address, requested file, user-agent and timestamp. Inquiry processing also uses the technical data listed in 3.0. We do not use this data for visitor analytics.
The 3D cog on the home page runs on three.js, which is bundled into the site itself rather than pulled from a CDN. It spins and it reports nothing.
Order, quote and contact forms
The forms at /quote and /contact send JSON to /api/inquiry, a Cloudflare Worker on fixedgearstraps.com. The Worker stores each request in Cloudflare D1, then sends it through Resend to quotes@fixedgearstraps.com. Migadu hosts the domain’s mailboxes and forwards the message to the business inbox at Fastmail.
The fields are name, email and optional phone; for volume quotes, optional company and buyer type; the product selected (GH-1 Pedal Straps, Strap & Pedal Set, Fixed-Gear Starter Kit, volume quote or general), quantity, colorways, strap length, timing, and free-text notes or a message. The contact form also asks for a topic. We use these details to prepare an order or quote and answer your message.
Technical data includes a rate-limit key derived from the IP address — the IPv4 address or the /64 prefix for IPv6 — a truncated browser user-agent, timestamps and email-delivery status events returned by Resend. Rate limiting and a hidden honeypot field help stop abuse. The forms set no cookies and use no captcha.
The Worker rejects a submission that looks like it contains a payment card number with HTTP 422 before storing, emailing or logging it. Card numbers are never stored. Do not enter card details in any form field.
After a successful submission you see a reference shaped GH-XXXX-123. No confirmation email is sent to you; a person at the bench replies personally. The form sends a request and does not take payment or accept an order. You can also email quotes@fixedgearstraps.com or call +1 (762) 760-1179.
Form correspondence is kept for two years from the last message in the thread. The D1 copy is purged automatically two years after receipt, and email-delivery status events are purged after 90 days. Section 10.0 sets out the other record types.
Webfonts
In plain EnglishLoading the typefaces sends your IP address to Google in the United States and to a type foundry in India. You can block those font requests.
The site loads three typefaces from two providers: Archivo and Space Mono from Google Fonts, at fonts.googleapis.com and fonts.gstatic.com, and Clash Display from Fontshare, at api.fontshare.com. The consent manager and optional chat in 2.0 also make third-party requests. Form requests use the services in 3.0.
A font request is still a request. When your browser fetches those files it hands the provider your IP address, your user-agent string and the page you were on when it asked. Google Fonts is operated by Google LLC in the United States. Fontshare is operated by Indian Type Foundry in India. If you are reading this from the EEA or the UK, that is personal data leaving your country for the United States and for India.
On safeguards, the honest answer: we have no contract with either provider, no standard contractual clauses of our own covering these requests, and no transfer impact assessment on file. We rely on the terms each provider publishes for its font service. If that is not good enough for you, the fix is to stop the request rather than to take our word for it.
Neither request sets a cookie on this site and nothing is written into your browser. That does not make the IP transfer disappear, which is why it is written down here rather than left out.
You can block it. Turn off third-party font loading in your browser settings, or use a content blocker or extension that blocks fonts.googleapis.com, fonts.gstatic.com and api.fontshare.com. The page falls back to the typefaces already on your machine. It looks blunter. Every word still reads.
Details you give us
You provide details through Stripe’s checkout, the forms, email, phone, chat or a note in a parcel. We also process the technical data in 3.0 and receive email-delivery status events from Resend.
| What we hold | How we got it |
|---|---|
| Name | You entered it at checkout or in a form, wrote it in an email or said it on the phone |
| Email address | You entered it at checkout or in a form, wrote from it or gave it for order updates |
| Postal address | You gave it so a parcel could find you, and at checkout a billing address if it differs |
| Phone number | Only if you offered one. We do not require it |
| What you ordered | The order itself — products, lengths, colorways, quantity, price |
| Payment record | From Stripe, for a checkout or payment-link order: whether it was paid, the amount and tax, the card brand and last four digits, and a payment reference. Never the full card number or security code |
| Shop or team name, and buyer type | Wholesale enquiries and quotes: bike shop, team or club, courier fleet, event or race, or other |
| Whatever you put in a message | You typed it or said it. Free text is free — we end up holding what you chose to write |
| Whatever you put in a chat | Only if you switched the chat widget on first — the transcript sits with tawk.to as well as in front of us |
| Guarantee and repair notes | What came back, what failed, what Ruth did about it, where it went afterwards |
Ruth is the 1978 bar-tack machine, not a person, in case that row read oddly.
We do not ask for a date of birth, a government ID number, banking credentials, health information, or anything about your race, religion, politics, union membership, sex life or sexual orientation. We have no use for any of it. If a message turns up with something like that in it, we do not act on it and we take it out of the record when we notice. Keep out of an email anything you would not want sitting in an inbox.
We buy no lists. We do not enrich what you gave us with data bought from anywhere else, and we build no profile on you. We use the records for the purposes in this policy.
Do you have to give us any of it? Only what the job needs. A name and a delivery address, or the parcel has nowhere to go. An email address or a phone number, or we cannot answer you. Withhold those and we cannot take the order — not a penalty, just the arithmetic of posting something to somebody. Everything else is optional: a phone number when you have already given an email, a shop name, the notes field. Leave them blank and the order still works. The only part the law itself requires is what ends up on the invoice for tax.
Payments
Card payment runs on Stripe, Inc. (USA). Buy now on a product page opens a checkout page hosted by Stripe at buy.stripe.com. There is no card-entry field on fixedgearstraps.com itself. At checkout you give Stripe your email, the colorway and length you want, your delivery address, your card details and, if it differs, your billing address.
Stripe processes the card details and keeps them; we never receive the full card number or security code. What comes back to us is the order: your name, email and addresses, what you chose, and the payment record in 5.0. Stripe also uses payment data for its own purposes, such as fraud prevention and meeting its legal duties, under its own privacy policy at stripe.com/privacy. Stripe may offer to save your details with Link, its own service. That is between you and Stripe, and you can skip it.
Stripe’s checkout page sets its own cookies and runs its own fraud checks on its own domain, under Stripe’s policies, not ours. Nothing from Stripe loads on fixedgearstraps.com.
No card details belong in forms, email, phone messages or chat. For custom or volume work, your explicit approval of a written, itemized quotation in USD is required before a payment link is issued or any charge is made.
Our legal bases
In plain EnglishEuropean and UK law says we need a specific reason to hold anything about you. This table gives the reason for each thing we do, in the order the law numbers them.
| What we do it for | Basis under GDPR Article 6 | The reasoning |
|---|---|---|
| Preparing an order you request, then packing and shipping it | Contract, and steps before a contract — Art. 6(1)(b) | We need the request details to confirm the order and the delivery details to send it |
| Preparing a quote you request through a form, email or phone | Contract, and steps before a contract — Art. 6(1)(b) | A written quote holds its price for 14 days, so it has to exist for at least that long |
| Answering a contact-form message, email or phone call | Legitimate interests — Art. 6(1)(f) | Our interest is running a workshop that answers people. Low risk, and you started the conversation |
| Honoring the lifetime restitch guarantee | Contract, and legitimate interests — Art. 6(1)(b) and (f) | The guarantee has no time limit and follows the strap to a second owner, so the record has to outlive the sale |
| Spotting fraud and chargeback abuse | Legitimate interests — Art. 6(1)(f) | Our interest is not being defrauded. Form abuse checks are automated; order and pricing decisions are made by a person, without profiling |
| Protecting the inquiry forms and checking email delivery | Legitimate interests — Art. 6(1)(f) | Our interest is preventing abuse and making sure requests reach the bench. We use the technical data in 3.0 for those purposes |
| Keeping tax, accounting and sales records | Legal obligation — Art. 6(1)(c) | US federal and Georgia record-keeping rules want books that back up the numbers |
| Anything optional you say yes to | Consent — Art. 6(1)(a) | You can withdraw it whenever you like, and withdrawing does not undo what was lawful before |
We use legitimate interests to answer messages, prevent abuse and check email delivery, weighing those needs against your privacy. If you disagree with that balance, 11.0 tells you how to object, and objecting costs you nothing.
Who we share it with
The providers below receive data for the roles described. The font providers and their requests are listed in 4.0. Other recipients are listed by role where no provider name is specified.
| Who | What reaches them | Why |
|---|---|---|
| Stripe, Inc. (USA) | Everything you enter on Stripe’s checkout page: email, delivery and billing addresses, card details, the colorway and length you pick, plus the amount and reference | To take card payment on its own hosted page, calculate sales tax in any state where we are registered to collect it, and prevent fraud |
| The carrier | Name, delivery address, and a phone number or email for delivery notices | To put the parcel in your hands |
| Cloudflare, Inc. (USA) | Website connection data, form fields and the technical data in 3.0 | Hosting, the inquiry Worker and D1 request storage |
| Resend (resend.com, USA) | The request message and addressing details; delivery-status events returned to us | Emailing the request to quotes@fixedgearstraps.com and reporting delivery status |
| Migadu (migadu.com) | Business email content and addresses, including form-request emails | Hosting the domain’s mailboxes and forwarding messages |
| Fastmail (sent.com) | Forwarded messages, correspondence and addresses | The business inbox where we receive and answer messages |
| Our accountant | Order and payment records, invoices, the books | Tax returns and annual accounts |
| Termly, the consent manager | Your cookie choice and the consent record tied to it | To remember what you answered, and to keep the proof that we asked |
| tawk.to, the live-chat provider, and its subprocessors | Only if you switch the chat on: your messages and submitted details, IP address, browser and device data, pages and session activity, approximate location, timestamps | To run chat and support you after a Performance-category opt-in or a click on “Chat with the bench” |
| A court, regulator or law enforcement | Only what a lawful order actually compels, and no more | Because we have to. We will tell you it happened unless we are legally barred from telling you |
| A buyer of the business | Whatever is in the records at that point | Only if Gearhold is ever sold or merged. Not planned, not in progress, and this policy would have to travel with the records |
That is the whole list. We do not sell personal information and never have. We do not share it for cross-context behavioral advertising. We run no ad trackers, no data brokers and no affiliate pixels, and there is no advertising identifier here to hand anyone even if we wanted to.
Crossing borders
Website requests, form submissions, correspondence, chat and shipping can involve international processing:
- The webfont requests in 4.0, which send your IP address, user-agent and referring page to Google LLC in the United States and to Indian Type Foundry in India. This one you can block, and 4.0 says how.
- Chat messages, if you switch the chat widget on: tawk.to and its subprocessors process them internationally, from wherever you are reading this. Off by default, and 2.0 says what switching it on turns on.
- Form submissions are handled by Cloudflare, Inc. and Resend, both USA providers, and the resulting emails pass through Migadu to Fastmail. Sending a form or email from outside the United States involves international processing.
- Card payments are processed by Stripe, Inc. in the United States and by Stripe affiliates and card networks wherever they operate.
- Your order details, if you are outside the United States. We are in Georgia. Your name and address travel to us here, and then to the carrier that takes the parcel the rest of the way. There is no version of shipping you a strap that skips this.
- A customs declaration, on anything crossing into another country, which carries your name and address into that country border system. Required by law, not by us, and not something either of us can opt out of.
On the legal machinery: there is an adequacy route for US companies certified under the EU–US Data Privacy Framework and its UK extension. We are not certified under it, so we do not claim it. We hold no standard contractual clauses with our own suppliers and no transfer impact assessment. What we do instead is hold as little as possible, for as short a time as the guarantee and the tax rules allow. If that is not an acceptable trade, do not send us the order — we would rather lose the sale than mislead you about it.
How long we keep it
| Record | How long | Why that long |
|---|---|---|
| Order, invoice and payment records | Seven years from the end of the tax year | Our working practice, set to cover US and Georgia record-keeping comfortably. Treat it as our rule, not as a citation |
| Written wholesale quotes we issue | Two years from the date we sent it, longer if it turned into an order | This row covers the quote we issue, not the inbound form copy or correspondence, which have the separate periods below |
| Email correspondence | Two years from the last message in the thread, then deleted | Long enough to remember the conversation, short enough not to become a library |
| Guarantee and repair records | Indefinitely, in the shortest useful form | The restitch guarantee has no time limit and follows the strap to a second owner, so the record has to outlive the sale |
| Notes from a phone call | Deleted once the thing they were about is finished | They are notes on a bench, not a database |
| Form requests and related correspondence | Two years from the last message in the thread, then deleted; the D1 copy is purged automatically two years after receipt | To answer requests and retain the conversation; D1 has its own receipt-based expiry |
| Email-delivery status events | 90 days, then purged | To check and troubleshoot email delivery |
| Chat transcripts | Held in the tawk.to dashboard for as long as our settings there keep them; a deletion request to us is actioned there or passed on | The provider runs the chat, so the record lives in their system rather than ours |
Where a record has to stay for tax, we cut it back to what the tax rule needs: who bought, what, when, for how much. The conversation around it goes.
Your rights in the EU and UK
In plain EnglishYou can ask what we hold, have it corrected, have it deleted, take a copy elsewhere, or tell us to stop. It is free, we do not ask why, and it is one email.
If the GDPR or the UK GDPR applies to you, these are yours by right. We honor them for anyone who asks, wherever they live, because running two standards would take more effort than running one good one.
- Access. Ask what we hold about you and get a copy of it.
- Rectification. Tell us something is wrong and we correct it.
- Erasure. Ask us to delete it, and we do, except where a tax record has to stay or an order is still open.
- Restriction. Tell us to stop using something while a disagreement about it gets sorted out.
- Portability. Get the data you gave us in a machine-readable file, or have it sent on where that is technically workable.
- Objection. Object to anything we do on legitimate interests. Say so and we stop, unless we have a compelling reason we can show you.
- Withdraw consent. For anything optional you agreed to. Withdrawing does not make what happened before it unlawful.
- Complain. Take it to your national supervisory authority. In the UK that is the Information Commissioner’s Office; in the EU it is the authority where you live or work.
We do not make decisions with legal or similarly significant effects by solely automated processing, and we do not profile you. A person decides your order, price and guarantee claim. The forms use automated validation, card-number rejection, rate limiting and a honeypot to stop abuse.
To use any of them, email hello@fixedgearstraps.com saying what you want, call +1 (762) 760-1179 during Tue–Sat 10–18 ET, or post the request to the address in 16.0. It is free and we do not ask your reasons. We answer within one month. If a request is genuinely complicated we will tell you inside that month and may take up to two further months, which is the limit the law sets.
We may ask a question or two first, to be sure we are handing your data to you rather than to someone who knows your name. Writing from the address we already have on file usually settles it.
The step-by-step, including what to put in the message so we can act on it straight away, is at /legal/your-data.
Requests for access, correction, export or deletion cover form records in Cloudflare D1, related delivery events still held and the copies in our email services, as well as other records described here. Give us the email address you submitted and, if available, the GH-XXXX-123 reference.
California privacy rights
In plain EnglishCalifornians get a specific list of rights with its own vocabulary. We do not sell or share your data, so parts of the list have nothing to bite on — but here is the whole thing anyway.
If you are a California resident, the CCPA as amended by the CPRA gives you the rights set out below. It uses statutory categories, so this section uses them too. The table covers the twelve months before the effective date at the top of this page.
| Statutory category | Collected? | What it means here |
|---|---|---|
| A. Identifiers | Yes | Name, postal address, email, optional phone and the IP-derived key used for form rate limiting |
| B. Customer records (Cal. Civ. Code 1798.80(e)) | Yes | Name and address tied to a purchase, and the fact that a payment was made |
| C. Protected classification characteristics | No | Race, color, religion, age, sex, disability and the rest of the protected list. We do not ask and we have no use for it |
| D. Commercial information | Yes | What you ordered or asked us to quote: products, quantities, colorways, order history |
| E. Biometric information | No | We have no use for it and no way to collect it |
| F. Internet or other electronic network activity | Yes | Inquiry rate-limit key, truncated user-agent, timestamps and email-delivery status; while chat is active, pages viewed and session activity. We run no visitor analytics |
| G. Geolocation data | Only if you switch the chat on | tawk.to processes approximate location while active. We do not request precise location; a shipping address is used for delivery |
| H. Audio, electronic, visual or similar sensory information | No | We do not record calls |
| I. Professional or employment-related information | Yes, for wholesale only | Shop or team name and buyer type, when you ask for a trade price |
| J. Education information | No | We have never asked and would not know what to do with it |
| K. Inferences drawn to create a profile | No | We draw none. There is no profile to draw them into |
| Sensitive personal information (Cal. Civ. Code 1798.140(ae)) | No | No government IDs, no account credentials, no precise geolocation, nothing about race, religion, union membership, health, sex life or sexual orientation |
Sources are the details you submit, connection data from your browser, session data from chat when active, and delivery-status events from Resend. Purposes are preparing quotes and orders, answering messages, preventing abuse, checking delivery, honoring the guarantee, running requested chat and keeping the books. It is disclosed for those business purposes to the categories of recipient listed in 8.0, and to nobody else. How long each kind of record stays is set out in 10.0.
On opt-out preference signals: a browser can send a Global Privacy Control signal, and some send a Do Not Track header. We do not read these headers. We do not sell personal information or share it for cross-context behavioral advertising. The Do Not Sell or Share link goes to /legal/your-data, where you can put a request on record. Optional chat stays unloaded until you opt in or click the chat button.
- Right to know. What we collected, where it came from, why we have it, and who we disclosed it to.
- Right to delete. With the exceptions the statute allows, which here means tax records and anything needed to finish a transaction you asked for.
- Right to correct. Anything inaccurate, put right.
- Right to opt out of sale or sharing. There is nothing to opt out of. We do not sell personal information and we do not share it for cross-context behavioral advertising. The Do Not Sell or Share My Personal Information link in the footer is there because you are entitled to find one, and it lands on our Your data page, where you can put the request on record and get it confirmed in writing.
- Right to limit the use of sensitive personal information. We collect none, so there is nothing to limit.
- Right to non-discrimination. Same price, same straps, same guarantee, whether or not you exercise any of this. We run no loyalty program and offer no financial incentive for your data.
Three ways to submit a request: email hello@fixedgearstraps.com, call +1 (762) 760-1179 during Tue–Sat 10–18 ET, or post it to Gearhold LLC, 104 S Cherry St, Tunnel Hill, GA 30755, USA. We confirm receipt within 10 business days and answer within 45 days. If we need longer we will say so inside those 45 days and take up to 45 more, which is what the law allows.
An authorized agent can make a request for you. Send written permission signed by you, and we will still check with you directly before handing anything over.
We do not knowingly sell or share the personal information of anyone under 16, for the same reason we do not sell or share anyone else.
Other states have written their own versions since — Virginia, Colorado, Connecticut, Texas, Oregon, Montana and a lengthening list behind them. Most only bite on businesses far larger than this one, and we are almost certainly under every threshold they set. It makes no difference here. Ask by any of the three routes above and you get the same answer on the same clock as everyone else. Nobody should have to work out which statute they live under before we will talk to them.
Children
This site is not directed to children under 13. We do not knowingly collect anything from them. There is no account to create and we do not ask for an age in the forms. Straps are hardware for a bike, and the buying is done by adults.
If you are a parent or guardian and you think a child has sent us something, email hello@fixedgearstraps.com or call +1 (762) 760-1179. We will find it, delete it, and tell you what there was and that it is gone. No court order needed, no form to fill in. Just ask.
Security
We hold form requests in Cloudflare D1, email correspondence, order files and accounting records. The Worker rejects suspected card numbers before storage, email or logging and uses rate limiting and a hidden honeypot. There are no customer accounts or card fields and no visitor analytics store.
Access to business records stays with the people who run the workshop. Card entry happens on Stripe’s hosted checkout page, never on this site. The fuller account is at /legal/trust-security.
What we do not have, said plainly so nobody has to guess: no SOC 2 report, no ISO 27001 certificate, no PCI-DSS attestation of our own, no penetration test, no bug bounty, no security team and no cyber insurance. A workshop this size does not have those, and we are not going to imply otherwise.
No arrangement is perfect. If a breach ever touches your personal data we will tell you without undue delay — what happened, what was in it, what to do about it. Where the GDPR or the UK GDPR applies we notify the supervisory authority within 72 hours of becoming aware of it; we have no establishment in the EU and no lead authority, so that means the authority for the people affected rather than one regulator standing in for the rest. Where a US state breach law applies we follow that one, including the Georgia rules for Georgia residents. You will hear it early with an incomplete picture rather than late with a tidy one.
If you have found a security problem, write to security@fixedgearstraps.com or hello@fixedgearstraps.com. We will thank you for it, not threaten you over it.
Changes to this policy
When this changes, the effective date at the top of the page changes with it, and the current version is always the one sitting at /legal/privacy. For anything material — a new category of data, a new kind of recipient, a new purpose — we will say what changed and when, in a short dated note on this page.
20 Aug 2026: the site added a consent manager (Termly) and an optional live-chat widget (tawk.to), and sections 1.0, 2.0, 4.0, 5.0, 6.0, 8.0, 9.0, 10.0 and 12.0 were updated to describe them. Nothing else about what we hold, why we hold it or how long we keep it changed.
29 Oct 2026: order, quote and contact forms now submit to a Cloudflare Worker, D1 and Resend, with mailbox delivery through Migadu to Fastmail. Added form fields, technical data, retention and rights coverage. Chat can also load when you click “Chat with the bench”.
30 Oct 2026: card payment went live on Stripe’s hosted checkout. Sections 5.0, 6.0, 8.0, 9.0 and 14.0 now describe what Stripe collects at checkout, the payment record that comes back to us, and Stripe’s own role. Nothing else about what we hold, why we hold it or how long we keep it changed.
We do not run a mailing list or subscriber file for policy updates. Check the effective date and dated notes on this page, or ask us for the version that applied to your order.
We keep the previous wording. If you want to know what a clause said on the day you ordered, ask and we will tell you.
How to reach us
Gearhold LLC, 104 S Cherry St, Tunnel Hill, GA 30755, USA. A letter reaches the same bench as everything else.
- General questions and every privacy request: hello@fixedgearstraps.com
- Wholesale quotes: quotes@fixedgearstraps.com
- Phone: +1 (762) 760-1179, Tue–Sat 10–18 ET
Privacy requests go to hello@fixedgearstraps.com. Security reports can go to security@fixedgearstraps.com, which is also listed in security.txt. These addresses reach the business; the address above is our operational and customer-service address.
If you are in the EEA or the UK and you think we have got any of this wrong, you can complain to your own supervisory authority without coming to us first. We would rather start with a phone call and fix it, but it is your right and we will not make it awkward.